Case File: United States ex rel. Rachel Tenney v. Honeywell International Inc.
Case No.: 3:22-cv-129
Court: U.S. District Court, Western District of North Carolina
Settlement Amount: $2,042,518
Announced: September 1, 2026
Period at Issue: April 2020 through December 2023
Whistleblower: Rachel Tenney, a former Honeywell employee
Standard at Issue: NIST Special Publication 800-171
Status: Allegations only. There has been no determination of liability.
When a company works with the Pentagon, it is trusted with more than a product or a service. It is often trusted with information the military needs to keep protected, and that trust comes with written rules about how the information must be secured.
The Justice Department says Honeywell Aerospace fell short of those rules on one of its networks for nearly four years. On September 1, 2026, the department announced that the company agreed to pay $2,042,518 to resolve the claim. The company has not been found liable. The case is still a useful look at how a cybersecurity gap, with no breach alleged, can become a federal fraud matter.
Who Is Honeywell Aerospace?
Honeywell Aerospace Inc. is headquartered in Phoenix, Arizona. It supplies aerospace products and solutions to both government and commercial customers.
The company’s corporate status changed recently. Until June 29, 2026, it was a business segment of Honeywell International Inc., which is based in Charlotte, North Carolina. On that date it became a standalone public company. The conduct in this case falls in the earlier period, which is why the lawsuit names Honeywell International Inc. and not the newer company.
What the Government Says Happened
According to the Justice Department, from April 2020 through December 2023 a business unit of Honeywell International submitted claims for payment under a Department of Defense contract while not meeting that contract’s cybersecurity requirements. The allegations come down to four points:
- The requirements came from NIST Special Publication 800-171, a federal standard for protecting sensitive government information, and both the contract and the governing regulation required compliance with it
- The alleged gap concerned one of Honeywell’s networks, not the whole company
- The alleged non-compliance lasted for just under four years
- The payment claims submitted during that time are what the government says became false
The press release does not say which network was involved, what controls were missing, or what information it held. It also does not allege that a breach occurred. In its analysis of the case, the law firm Shumaker, Loop & Kendrick notes that a mismatch between what a company says about its security and what is actually in place can create liability even without a breach.
Why a Security Standard Becomes a Fraud Case
NIST SP 800-171 sets out safeguards for sensitive, unclassified government information held on contractors’ own systems. For defense contractors, the standard is built into federal contracting rules through the Defense Federal Acquisition Regulation Supplement, specifically clause DFARS 252.204-7012.
The False Claims Act connects the two. When a contract requires specific security controls and the company bills the government anyway, the government can argue that each invoice implied the company was meeting its obligations. If the company was not, the claims may be treated as false. The question was never only whether data was stolen. It was whether the company was delivering the protection it had promised in exchange for payment.
The Whistleblower Behind the Case
The case did not come from a government audit. Rachel Tenney, a former Honeywell employee, filed it under the qui tam provisions of the False Claims Act. Those provisions let private citizens sue on the government’s behalf and share in any money recovered.
Tenney receives $375,823 from the settlement, which works out to about 18.4% of the total. The docket number, 3:22-cv-129, points to a 2022 filing in the Western District of North Carolina, where Honeywell International is headquartered in Charlotte. The settlement resolves the claims without any ruling on who was right.
What the Officials Said
Assistant Attorney General Brett A. Shumate of the Justice Department’s Civil Division said contractors that obtain defense information must follow the required cybersecurity standards, and that the department will keep investigating possible violations.
U.S. Attorney Russ Ferguson of the Western District of North Carolina said these requirements exist “to protect government systems and prevent unauthorized access to government data.” He added that companies profiting from government contracts are obliged to make sure sensitive data is protected.
Not an Isolated Case
The Honeywell settlement sits inside a steady run of cybersecurity enforcement actions. Shumaker, Loop & Kendrick reports that in fiscal year 2025 the Justice Department recovered more than $52 million across nine cybersecurity-related False Claims Act settlements. That was part of a record $6.8 billion in total False Claims Act recoveries that year. The table below shows how Honeywell compares with the other cases the firm cites.
| Company | Amount | Announced | What was alleged |
|---|---|---|---|
| LOGZONE Inc. (Huntsville, Alabama) | $507,144 | June 2026 | Failing to implement NIST SP 800-171 controls under two Navy contracts |
| Georgia Tech Research Corporation | $875,000 | September 2025 | Missing antivirus tools and a required security plan on a sensitive DoD research system |
| Aero Turbine Inc. and Gallant Capital Partners | $1.75 million | July 2025 | Cybersecurity non-compliance in an Air Force contract |
| Honeywell Aerospace Inc. (Phoenix, Arizona) | $2,042,518 | September 2026 | Failing to meet NIST SP 800-171 requirements on one network under a DoD contract |
| MORSECORP Inc. (Cambridge, Massachusetts) | $4.6 million | March 2025 | Failing to meet cybersecurity requirements in Army and Air Force contracts |
| Raytheon, RTX and Nightwing entities | $8.4 million | May 2025 | No required system security plan and missing controls on an internal development system |
The LOGZONE and MORSECORP cases show the gap that enforcement targets. LOGZONE reported a perfect self-assessment score of 110 in October 2021, and a government assessment in February 2024 produced a score of -170 on a scale that runs from -203 to 110. MORSECORP reported a score of 104, and a consultant later put the real figure at -142. The Aero Turbine case adds a counterpoint: the Justice Department credited that company for disclosing the problem voluntarily, cooperating, and fixing it promptly, which reportedly lowered the damages multiplier to about 1.5x, compared with the typical 2x.
Remedi has not been found liable, and the settlement resolves the case without any court deciding who was right. What it does leave behind is a payment plan, a whistleblower case that started in 2020, and a reminder that a pharmacy’s paperwork is also the proof it relies on when it asks taxpayers to pay.
For anyone who wants to report suspected healthcare fraud, the Justice Department points to the Department of Health and Human Services tip line at 800-HHS-TIPS (800-447-8477).if the final collectible number still depends on what happens next at the appellate level.
SOURCE:
This article is based on the official Justice Department press release issued by the Office of Public Affairs on September 17, 2026, which was used to confirm the settlement amount, the allegation period, the case caption and number, the names of the whistleblowers, the payment structure, and the statements of Assistant Attorney General Brett A. Shumate, U.S. Attorney Dominick S. Gerace II and HHS-OIG’s Miranda L. Bennett. It is cross-referenced against coverage from McKnight’s Senior Living, which supplied the December 2020 filing date, the first installment amount, the separate retaliation claims, and the 2010 settlement, and against reporting from the Washington Times and a Maryland-focused enforcement roundup. The claims resolved by the settlement are allegations only, and there has been no determination of liability.